From: Thomas Gleixner <tglx@linutronix.de>
To: Chuck Ebbert <cebbert@redhat.com>
Cc: Johannes Bauer <JohannesBauer@gmx.de>,
linux-kernel@vger.kernel.org, schwab@suse.de
Subject: Re: x86_64 system lockup from userspace using setitimer()
Date: Tue, 13 Mar 2007 21:33:05 +0100 [thread overview]
Message-ID: <1173817985.13341.120.camel@localhost.localdomain> (raw)
In-Reply-To: <45F7033B.2030204@redhat.com>
On Tue, 2007-03-13 at 16:02 -0400, Chuck Ebbert wrote:
> > struct itimerval tim = {
> > .it_interval = {
> > .tv_sec = 140735669863712,
> > .tv_usec = 4199521
> > },
> Could this be fixed by:
>
> http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=8bfd9a7a229b5f3d3eda5d7d45c2eebec5b4ba16
>
> [PATCH] hrtimers: prevent possible itimer DoS
No. The possible DoS is only when high res timers are enabled, which is
not the case in 2.6.20.
Looking at the values
140735669863712 = 0x7FFF 939C 0520
We convert second to nanoseconds:
140735669863712 * 1e9 = 0x1DCD 4BC3 6B82 914B 4000
The seconds value is limited to LONG_MAX, but on a 64 bit machine, the
140735669863712 is inside LONG_MAX and we have an multiplication
overflow.
I'm not sure, how this results in a DoS, but I will look into this
tomorrow morning, when I'm more awake.
tglx
next prev parent reply other threads:[~2007-03-13 20:26 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-03-13 18:55 x86_64 system lockup from userspace using setitimer() Johannes Bauer
2007-03-13 19:19 ` Andreas Schwab
2007-03-13 20:02 ` Chuck Ebbert
2007-03-13 20:33 ` Thomas Gleixner [this message]
2007-03-14 10:00 ` [PATCH] hrtimer: prevent overrun DoS in hrtimer_forward() Thomas Gleixner
2007-03-14 10:08 ` Ingo Molnar
2007-03-16 20:43 ` Andrew Morton
2007-03-16 21:05 ` Thomas Gleixner
2007-03-18 21:16 ` Chuck Ebbert
2007-03-18 21:32 ` Thomas Gleixner
2007-03-18 21:53 ` Chuck Ebbert
2007-03-18 22:04 ` Thomas Gleixner
2007-03-18 22:02 ` Chuck Ebbert
2007-04-04 21:11 ` Adrian Bunk
2007-04-04 21:30 ` Thomas Gleixner
2007-04-09 13:01 ` Adrian Bunk
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1173817985.13341.120.camel@localhost.localdomain \
--to=tglx@linutronix.de \
--cc=JohannesBauer@gmx.de \
--cc=cebbert@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=schwab@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.